Loading story…
Attackers exploited CVE-2025-59287, a critical Microsoft Windows Server Update Services (WSUS) vulnerability, to deploy the ShadowPad backdoor. The CVSS 9.8 insecure deserialization flaw allows unauthenticated remote code execution with SYSTEM privileges through crafted SOAP/XML requests. AhnLab documented attacks following publication of proof-of-concept code: attackers established PowerCat command shells, downloaded malware using curl.exe and certutil.exe, and executed ShadowPad through DLL sideloading involving ETDCtrlHelper.exe, ETDApix.dll, and the payload 0C137A80.tmp. The malware configuration supported persistence and process injection, with command-and-control communication to 163.61.102[.]245:443 over HTTP or HTTPS. ShadowPad is associated with multiple China-linked espionage groups, but AhnLab did not attribute these attacks to a specific actor.
Separate CrowdSec monitoring recorded 1,020 exploitation signals over 32 days, beginning December 18, 2025, averaging approximately 32 daily and peaking at 52. CrowdSec characterized this activity primarily as focused reconnaissance for vulnerable WSUS configurations, rather than evidence of confirmed ShadowPad infections. Compromise of an update-management server could potentially enable malicious update distribution to connected clients, increasing the risk of network-wide compromise. Defenders should apply Microsoft's October 23, 2025 out-of-band updates or later applicable fixes, restrict WSUS exposure and access, and investigate unexpected shell execution, suspicious downloads, the documented sideloading files, and connections to the reported command-and-control endpoint.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
The CrowdSec Network first detected attempts targeting the WSUS vulnerability. The activity involved crafted SOAP/XML requests against WSUS API endpoints.
Attackers exploited CVE-2025-59287 to download encoded ShadowPad components from 149.28.78[.]189:42306 using curl.exe and decode them with certutil.exe. The deployment used ETDCtrlHelper.exe to sideload ETDApix.dll, with 0C137A80.tmp supplying the backdoor payload and configuration.
The campaign was identified in November 2025, with ASEC documenting DLL sideloading, persistence settings, process-injection targets, and a configured command-and-control endpoint at 163.61.102[.]245:443. ASEC did not attribute the attack to a specific threat group.
AhnLab Smart Defense recorded a PowerShell command downloading PowerCat from GitHub and connecting to 154.17.26[.]41:8080. ASEC assessed that this execution gave the attacker access to the target server's CMD shell.
Microsoft released out-of-band updates KB5070881 and KB5070882 to address the WSUS vulnerability.
Proof-of-concept code for CVE-2025-59287 became public. SecPod reports that threat actors began weaponizing the exploit that day.
Microsoft disclosed CVE-2025-59287, an insecure deserialization vulnerability in Windows Server Update Services. It allows unauthenticated attackers to execute code with SYSTEM privileges on vulnerable servers.
CrowdSec reported 1,020 exploitation signals over a 32-day observation period and identified 130 IP addresses attempting exploitation, more than 70% of which were labeled malicious. It characterized most activity as focused reconnaissance for vulnerable WSUS configurations and observed a gradual week-over-week decline.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
crowdsec.net
Open sourcesecpod.com
Open sourceasec.ahnlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors have exploited a critical deserialization vulnerability in Microsoft Windows Server Update Services (WSUS), identified as CVE-2025-59287, to gain remote code execution with system privileges and deploy the ShadowPad backdoor. The attackers targeted publicly exposed WSUS-enabled Windows Servers, using the PowerCat utility to obtain a system shell and then leveraging legitimate Windows tools such as `curl.exe` and `certutil.exe` to download and install ShadowPad from an external server. ShadowPad, a modular backdoor associated with Chinese state-sponsored groups, is loaded via DLL side-loading techniques, specifically using a legitimate binary to execute a malicious DLL payload in memory. The vulnerability, which was patched by Microsoft in October, allows remote, unauthenticated attackers to trigger unsafe deserialization of `AuthorizationCookie` objects, leading to full system compromise. Security researchers from AhnLab and others have documented the attack chain, noting that the flaw has been added to CISA's Known Exploited Vulnerabilities catalog and that a public proof-of-concept exploit is available. The incident highlights the ongoing risk posed by unpatched WSUS servers and the sophisticated methods used by threat actors to maintain persistence and evade detection once ShadowPad is installed.
Jun 29, 2026
A critical remote code execution (RCE) vulnerability was discovered in Microsoft's Update Health Tools (KB4023057), a utility designed to facilitate rapid security updates via Intune. Researchers found that a misconfiguration involving abandoned Azure blob storage allowed attackers to register a storage account and receive requests from vulnerable devices worldwide, enabling arbitrary code execution. Microsoft has since responded to the disclosure, and newer versions of the tool have addressed the issue, but devices running the original version remain at risk if not updated. Separately, a remote code execution vulnerability in Microsoft Windows Server Update Services (WSUS), tracked as CVE-2025-59287, was actively exploited by threat actors to deploy the ShadowPad backdoor malware. Attackers leveraged this flaw to gain system-level access using PowerCat and subsequently installed ShadowPad via `certutil` and `curl`. The exploitation of these vulnerabilities highlights the risks associated with update management tools and the importance of timely patching and secure configuration to prevent compromise by advanced persistent threats.
Jul 12, 2026
Researchers and incident responders have tied **ShadowPad**, a privately sold modular backdoor associated with multiple PRC-linked espionage operations, to both major supply-chain compromises and ongoing targeted intrusions. ShadowPad has appeared in high-profile cases including **CCleaner**, **NetSarang**, and **ASUS ShadowHammer**, while a separate campaign used a trojanized installer for Pakistan’s government **E-Office** application to sideload a malicious `mscoree.dll` loader and deploy an encrypted ShadowPad payload. Trend Micro observed victims in Pakistan spanning a government entity, a public sector bank, and a telecommunications provider, with follow-on activity including credential theft via Mimikatz and data exfiltration over PowerShell BITS. ShadowPad was also among the malware families deployed after mass exploitation of Microsoft Exchange zero-days, underscoring its role as a reusable espionage platform across both opportunistic and highly selective operations. Defenders have responded by reverse engineering ShadowPad’s custom TCP, HTTP(S), and UDP command-and-control protocols and using protocol emulation to scan the Internet for live servers that would evade reputation-based detection. VMware and Virus Bulletin research identified dozens of active ShadowPad C2 nodes—roughly **72 to 83 servers** across overlapping study periods—and found that some accepted multiple protocols on the same port and overlapped with infrastructure used by **Spyder** and **ReverseWindow**. One previously identified ShadowPad C2 IP later surfaced in a real incident response case, showing that proactive C2 discovery can expose stealthy intrusions before conventional indicators trigger. Researchers caution that ShadowPad’s commercial, shared-use model complicates attribution, making infrastructure correlation and long-term tracking more reliable than assuming any single actor is responsible.
Aug 15, 2026